Privacy policy

The short version

host0 hosts apps that you (or your agent) publish. To do that we keep your account details, the files you upload, and any shared records your apps store. We don't sell your data, we don't run ads, and we only use what we collect to run, secure and improve host0.

Who we are

host0 ("host0", "we", "us") operates the platform at host0.ai and serves published apps on *.host0.app. Questions about this policy or your data: support@host0.ai.

What we collect

Account data. Your email address, and a password hash if you set a password. If you sign in with Google, we receive your name, email address and profile picture from Google — nothing else from your Google account.

API keys and device logins. API keys are stored only as hashes, with a name, creation time and last-used time. Device-login codes are short-lived and expire on their own.

What you publish. The files of each app, its name and URL slug, its visibility (public, link or private), the email addresses you share it with, and the deploy history (times, sizes, file hashes).

Shared records. Data your apps write through the records API (/.h0/data/…), with the identity of whoever wrote it (user ID and email when signed in). This is your apps' data — we store it to serve it back.

Waitlist. If you join the waitlist, your email address.

Technical data. IP addresses and request metadata, used for rate limits, abuse prevention and debugging. On the marketing site we use Vercel Web Analytics, which counts page views without cookies and without building a profile of you.

How we use it

• To run host0: sign you in, store and serve your apps and records, and enforce who can see a private app.
• To keep it safe: rate limits, quotas, abuse investigations, and taking down content that breaks the terms.
• To talk to you about your account: sign-in codes, invites, and important service notices. No marketing email without your consent.
• To improve the product, using aggregate usage numbers.

We don't sell personal data and don't share it with advertisers.

Sharing and access

• People you share an app with see the app and, through it, whatever records it shows them. The emails you invite are stored so they can sign in.
• Visitors of public apps can see what the app shows. Public apps are unlisted and never indexed by search engines, but the URL is guessable — make an app private for anything sensitive.
• Service providers that process data on our behalf, only to run host0:
  • Supabase — database and authentication
  • Vercel — the control plane (host0.ai) and web analytics
  • Cloudflare — serving apps on *.host0.app and storing their files
  • Google — only if you choose "Continue with Google"
• Legal reasons — when required by law, or to protect host0, our users or the public.

Cookies

We use only the cookies the service needs:

• A session cookie on host0.ai that keeps you signed in;
• A host-scoped session cookie on a private app's own domain, set after you pass its sign-in gate;
• Short-lived cookies used during sign-in (e.g. the OAuth verifier).

Your light/dark theme choice is kept in your browser's local storage. We don't use advertising or cross-site tracking cookies.

Retention

We keep your account and its apps while your account exists. Deleted apps and accounts are removed from the live service, and residual copies in backups age out on our providers' backup schedules. Waitlist emails are kept until the waitlist is no longer needed or you ask us to remove yours.

Your rights

You can see your apps and keys in the dashboard, revoke keys yourself, and export any app's records as JSON. To access, correct, export or delete your personal data, or to object to how we use it, email support@host0.ai. Depending on where you live (for example the EU or UK), you may also complain to your local data protection authority.

Security

Passwords and API keys are stored as hashes, all traffic uses HTTPS, user content is served from a separate domain from the platform, and private apps check a signed, short-lived session on every request. No system is perfectly secure — please report vulnerabilities to support@host0.ai.

Children

host0 is not directed at children under 16, and we don't knowingly collect their personal data.

International transfers

Our providers may process data outside your country, including in the United States and the European Union, under their own contractual safeguards.

Changes

If we change this policy, we'll update the date at the top, and for material changes we'll let account holders know by email or in the dashboard.